xmrig

General

Target

32ee9adfcbbfc79ac4a2e376547729ad38d15a9b56cf43f40f7c93a0629fb171
Size

1.8MB
Sample

240521-zp5geaab63
MD5

bff093336377e83a059fb400d4f9ed90
SHA1

78ecf1f04a1b7165370801094ac1ad7b66457fc8
SHA256

32ee9adfcbbfc79ac4a2e376547729ad38d15a9b56cf43f40f7c93a0629fb171
SHA512

05f0cd62f1f2782c9ff9d5b82ddd8ae0ecd8141ae932aceeaaf77b8bcde67bb07dd15419cf76c4564db5fee66703c3ea1e6c32d75f322aa3f7a46cb184f1d9d6
SSDEEP

24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcmC3f/DFNkTQb5P0DJ8aQHLMatkLYk/iDz:knw9oUUEEDl37jcmWH/xbQJA9tuJahNr

Score

10^/10

Malware Config

Targets

- Target
  
  32ee9adfcbbfc79ac4a2e376547729ad38d15a9b56cf43f40f7c93a0629fb171
- Size
  
  1.8MB
- MD5
  
  bff093336377e83a059fb400d4f9ed90
- SHA1
  
  78ecf1f04a1b7165370801094ac1ad7b66457fc8
- SHA256
  
  32ee9adfcbbfc79ac4a2e376547729ad38d15a9b56cf43f40f7c93a0629fb171
- SHA512
  
  05f0cd62f1f2782c9ff9d5b82ddd8ae0ecd8141ae932aceeaaf77b8bcde67bb07dd15419cf76c4564db5fee66703c3ea1e6c32d75f322aa3f7a46cb184f1d9d6
- SSDEEP
  
  24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcmC3f/DFNkTQb5P0DJ8aQHLMatkLYk/iDz:knw9oUUEEDl37jcmWH/xbQJA9tuJahNr
Score

10^/10

xmrig miner upx
- Suspicious use of NtCreateUserProcessOtherParentProcess
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- UPX dump on OEP (original entry point)
- XMRig Miner payload
  miner
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtCreateUserProcessOtherParentProcess

UPX dump on OEP (original entry point)

XMRig Miner payload

Executes dropped EXE

Loads dropped DLL

UPX packed file

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2